feat: add whoami and doctor so a wrong identity stops being invisible

[s403o]

Reopened against main — the original #4 was auto-closed when its base branch was deleted on merge.

Why

Git gives you no way to ask which rule matched. An includeIf that never fires produces no warning, no error, and exit status 0 — it silently falls through. So every wrong-identity failure presents to the user as nothing at all.

What this adds

gitmeright whoami — the resolved identity for this repo, which rule matched, and the key in use. When nothing matches it says why, specifically:

profile   ✗ none matched

git will refuse to commit here — that is deliberate.

rules checked:
  ✗ personal     host matches, org does not (expects s403o/)
  ✗ work         different host (expects gitlab.com)

Exits non-zero on a miss, so it is scriptable.

gitmeright doctor — ten read-only checks, each with an actionable remedy: git version against the 2.36/2.13 floors, every profile resolved against a fixture repo, rules that can never match, IdentitiesOnly presence, key existence and mode, ~/.ssh permissions, duplicate or missing includes, and a global [user] that would silently shadow every profile.

--online connects to each host and reports which account actually answered — the check that catches the failure where user.email is right but ssh authenticates as someone else.

Testing

64 tests green, 15 new. A broken state is constructed per check, asserting doctor flags precisely that one. Both commands are read-only and there are tests asserting they write nothing.

One bug these tests caught during development: doctor reported a mode-644 key as an "incomplete pair", because ssh-keygen refuses to read a world-readable key. Permissions are now checked before readability so the message points at the real fault.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.